Interim Data Retention Notice

Interim status

This notice replaces earlier public copy that gave conflicting fixed retention and deletion periods. VantaWeb is reconciling its database, object storage, logs, backups, sub-processor behavior, customer contracts, and deletion jobs into one approved schedule.

Do not rely on an earlier 30-day, 90-day, 12-month, or “term plus 90 days” statement as a universal promise. Retention varies by data category, customer configuration, legal obligations, operational need, and the behavior of the processor that holds the data.

Current operating boundary

• Account, call, transcript, message, support, security, and billing records do not all share one retention period.
• Some deletion is request-driven or performed through periodic operational review; automated deletion is not represented as complete for every store.
• Deleted production data may remain in encrypted or provider-managed backups until the applicable backup lifecycle expires.
• Financial, tax, fraud-prevention, dispute, security, and legal-hold records may be retained when required or reasonably necessary.
• Sub-processors may maintain their own narrowly scoped service, security, or billing records under their contracts and published policies.

Customer-specific terms

A signed order form, DPA, or other customer-specific agreement may establish a retention setting or deletion obligation for a particular deployment. The signed agreement controls over this interim website notice. VantaWeb will not promise a configurable minimum, automatic purge date, or deletion SLA unless that behavior has been verified for every affected store and written into the applicable agreement.

Deletion requests

To request access, correction, or deletion, email privacy@vantaweb.io with enough information to identify the account or interaction. VantaWeb will verify the requester, identify applicable exceptions, and provide the available scope and expected timing in writing. A request may not remove records that must be retained for law, security, billing, dispute resolution, or legal hold.

Acceptance gate for a fixed schedule

A future version will publish category-by-category periods only after each period is mapped to its production store, deletion mechanism, backup expiry, sub-processor behavior, owner, test evidence, and contract language. Until then, the Privacy Policy and executed customer documents should avoid contradictory fixed-period claims.

Contact

Privacy and retention questions: privacy@vantaweb.io.